[sacm] New version of SWIMA - draft-ietf-sacm-nea-swid-patnc-01

["Schmidt, Charles M." <[e-mail]>]

Hi all,

A new version of SWIMA has been uploaded to the IETF document repository (https://datatracker.ietf.org/doc/draft-ietf-sacm-nea-swid-patnc/) and to the GitHub repo (https://github.com/sacmwg/software-identification). This new draft includes some rearrangement to make it easier to read and a bit shorter (thanks Dave Waltermire). I believe this version now addresses all issues currently listed in GitHub.

The biggest change between the -00 and -01 versions is in the source identification mechanisms. The Source First Use flag was removed from all messages per the suggestions at the virtual interim call. I have also added two new attributes: Source Metadata Request and Source Metadata Response. These are used to convey information about the various sources a SW-PC uses. These attributes are described in sections 5.14 and 5.15. The section on Source Identifiers (section 3.4.5) has been expanded to provide more guidance on source handling and tracking. This addresses open issue #1 in GitHub.

All of the other issues were addressed in the -00 version. No concerns were raised about the approaches used there either at the last virtual interim call or in response to request for feedback on the mailing list. For simplicity, I'm adding the list of issues addressed in the -00 version along with how they were addressed and where.

Issue #3: Include installation location - Section 3.4.4 describes how software location information is captured when reporting records, and all attributes that deliver records have new fields used to indicate the software location.
Issue #4: Support of user/vendor-defined data models - The data model is indicated with a combination of PEN and data model type identifier. Each vendor can use their PEN to define their own namespace of data model type identifier values. The spec also reserves all values greater than or equal to 192 in the IANA PEN (0) as definable by the local enterprise. Section 3.2 discusses data models in more detail, section 3.4.2 describes how data model information is captured in records, and all attributes conveying software data records have fields to capture this. In addition, section 10.4 describes the IANA registry for Software Data Models.
Issue #5: Clarify that SWIMA servers (specifically SW-PVs) MUST accept all data models - This is included in section 3.2
Issue #6: MTI Data Models - Also addressed in section 3.2. Requirement is to support (i.e., be able to generate Software Identifiers for) the formats specified in section 5 of the spec. Currently, those are SWID 2015 in XML and SWID 2009 in XML. No other formats have been suggested.

Please take a look at this new version and send any feedback to the list.

Thanks,
Charles